Skip to main content

Apache HTTP Server EUVDEUVD-2026-35094

| CVE-2026-44119 MEDIUM
Improper Privilege Management (CWE-269)
2026-06-08 apache GHSA-fm8w-r4qw-vq3r
Privilege Escalation Apache Apache Http Server Apache Software Foundation
5.5
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Analysis Generated
Jun 09, 2026 - 13:23 vuln.today
CVSS changed
Jun 09, 2026 - 13:22 NVD
5.5 (None) 5.5 (MEDIUM)
CVE Published
Jun 08, 2026 - 15:17 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 08, 2026 - 15:17 nvd
MEDIUM 5.5

DescriptionCVE.org

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

This issue affects Apache HTTP Server: from through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

AnalysisAI

Privilege escalation in Apache HTTP Server 2.4.0 through 2.4.67 allows local users with .htaccess write access to read arbitrary files using the privileges of the httpd daemon process, exploiting improper privilege management (CWE-269). The attack vector is local, requires low privileges, and impacts only confidentiality - no integrity or availability impact is present. No public exploit code and no active exploitation have been identified; SSVC classifies technical impact as partial and the vulnerability as non-automatable, consistent with the targeted, local nature of the attack.

Technical ContextAI

Apache HTTP Server supports per-directory configuration overrides via .htaccess files, which allow delegated control over server behavior within designated directories. The root cause, CWE-269 (Improper Privilege Management), indicates that the server fails to enforce adequate privilege boundaries when processing .htaccess directives - allowing an author of such a file to direct the httpd process to access files that the .htaccess author themselves would not be permitted to read directly. Because the httpd daemon runs under a dedicated service account (typically 'www-data', 'apache', or 'httpd'), it may have read access to sensitive configuration files, application secrets, or system data not normally accessible to unprivileged local users. Affected product is identified via CPE cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:* covering the full 2.4.x branch through 2.4.67, as confirmed by ENISA EUVD-2026-35094 and the Apache security advisory.

RemediationAI

Upgrade to Apache HTTP Server 2.4.68, which contains the vendor-released fix per the official Apache security advisory at https://httpd.apache.org/security/vulnerabilities_24.html. This is a confirmed patch version from the Apache Software Foundation. If immediate upgrade is not possible, restrict .htaccess functionality by setting 'AllowOverride None' in the relevant Directory blocks of the server configuration - this disables .htaccess processing entirely and eliminates the attack surface, though it may break per-directory application configurations that rely on .htaccess overrides. Alternatively, audit and restrict filesystem write permissions so that only fully trusted accounts can modify .htaccess files. In shared-hosting environments, consider chroot jails or per-vhost process isolation (e.g., mod_ruid2 or suEXEC) to limit the files readable by the httpd process in a given vhost context. Note that disabling AllowOverride may require migrating application-level .htaccess directives into the main server configuration, which carries an operational cost.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

EUVD-2026-35094 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy